Chapter 8 Outline

Chapter 8 Outline

A. Physical access negates all other security measures. No matter how impenetrable the firewall and the intrusion detection system are, if an attacker can find a way to walk up and touch the server, he can probably break into it.

B. Physical access allows an attacker to do a number of things, such as plugging into an open Ethernet jack.

1. The advent of hand-held devices with the capability to run operating systems with full networking support has made this attack more feasible.

2. Originally, the attacker would have to be in a secluded area with dedicated access to the Ethernet for a time. This would allow an attacker to sit with a laptop and run several tools against the network. Being internally based typically puts them behind the firewall and the intrusion detection system.

a) However, PDAs can assist an attacker by having a small device that could be placed onto the network, which acts as a wireless bridge. This allows an attacker to use a laptop to attack a network remotely from outside the building.

b) An attack can also be done with an off-the-shelf access point if power is available near the Ethernet jack.

C. Another simple attack that occurs when an attacker has physical access is called a bootdisk.

1. Before the advent of bootable CD-ROMs in computers, a boot floppy was used to start the system and prepare the hard drives to load the operating system. As most machines still have floppy drives, boot floppies can still be used.

a) These floppies can contain an NTFSdos or a floppy-based Linux distribution. This enables them to perform a number of tasks including mounting the hard drives and performing at least read operations.

b) Once an attacker is able to read the drive, the password file can be copied off the machine for offline password-cracking attacks.

c) If write access to the drive is obtained, the attacker could alter the password file, or place a remote control program to be automatically executed upon the next boot, guaranteeing continued access to the machine.

2. Bootable CD-ROMs are a threat, as they can contain a bootable version of an entire operating system with drivers for most devices, thus giving an attacker a greater array of tools than could be loaded onto a floppy disk. These bootable operating systems could also be custom-built to contain any tool that runs under Linux, allowing an attacker to have a standard bootable attack image.

3. The use of bootdisks enables attackers to make an image of the hard drive for later investigation. This is because some form of bootable media is often used to load the imaging software.

a) Drive imaging is the process of taking the entire contents of a hard drive and copying them to a single file on a different media.

b) Typically, a bootable media is used to start the computer and load the drive imaging software. This software is designed to make a bit-by-bit copy of the hard drive to a file on another media, usually another hard drive or a CD-R/DVD-R burnable media.

4. A simpler method of the drive imaging attack is outright theft of computers. The attackers may perform the theft for the financial value of computers. Stealing the computer can also allow an attacker to obtain important data.

5. Many of these attacks, such as computer theft, can be used to perform a Denial-of Service (DoS) attack.

II. Physical Security Safeguards

A. Although it is difficult to be totally secure, there are many steps that can be taken to mitigate the risk to information systems from a physical threat.

B. Policies and procedures.

1. Policies and procedures can be developed to address issues concerning the computer system and the computer users.

2. To mitigate the physical security risk to computers, it is important to extend physical security needs to the computers.

3. To combat the threat of bootdisks, organizations must remove or disable floppy drives from all desktops that do not require them.

4. The second boot device to consider is the CD-ROM/DVD-ROM.

a) The CD-ROM can also be used as a boot device. It can also be exploited using the auto-run feature that some operating systems support.

b) If the auto-run is programmed maliciously, it could run an executable that installs malicious code to allow an attacker to gain control of the machine remotely.

5. If removal of the CD-ROM drive is not feasible, and especially on machines that require a CD-ROM, BIOS passwords should be set.

6. Setting a password on the BIOS delays or prevents an attacker from resetting the boot sequence to boot from a device other than the hard drive.

C. USB ports have expanded the ability for users to connect devices and have them autorecognize and work, usually without needing additional drivers or software.

1. If USB devices are allowed, aggressive virus scanning should be implemented.

2. The devices can be disallowed by:

a) Disabling the USB devices if running operating systems such as Windows 2000 or XP.

b) Unloading and disabling the entire USB driver if running an operating system that does not support disabling of the device.

D. Another physical access attack that can be performed is outright theft of machines.

1. This attack can be mitigated by locking the machines that contain sensitive data. Though insurance can cover the loss of the physical equipment, theft can impact the business for a long period.

2. Another method is to have special access controls for server rooms.

3. From a data standpoint, alternate storage, other than a server, should be considered for storing mission-critical or high-value information.

E. Computer users are considered to be the weakest link in the security chain. This also applies for physical security. Users need to be aware of security issues and also need to be involved in security enforcement in their organization.

1. Users should be instructed to contact the appropriate departments or personnel when they suspect a security violation.

2. They should also lock the workstation immediately when they step away from it.

3. Security guards need to be educated about proper network security as well as physical security involving users.

F. Access controls.

1. Access control refers to physical barriers.

2. Layered access is an important topic in security.

a) To prevent an attacker from gaining access to important assets, several physical barriers should be put around those assets.

b) Servers should be placed in a separate secure area, ideally with a separate authentication mechanism.

(1) Access to the server room should be limited to staff with legitimate need to work on the servers.

(2) To layer the protection, the area surrounding the server room should also be limited to the people that work in that area.

3. Many organizations use electronic access control systems to control the opening of doors.

a) A centralized system can instantly grant or deny access based upon a token that is given to the user. It can also log user access providing non-repudiation of a specific user’s presence.

b) As a precaution, the computer running software programs for such systems should not be attached to the company network.

4. Closed circuit television systems (CCTV) are similar to the door control systems. They can be very effective, but should be carefully implemented. Many IP-based CCTV systems provide additional functionality, such as surveillance of a building through the Internet. Therefore, if CCTV cameras are going to be IP-based, they should be placed on a separate, network that can be accessed only by security personnel.

G. Authentication.

1. Authentication is the process by which users prove they are who they claim to be. It is performed to allow or deny access to a physical space.

2. The purpose of any access control system is to allow access to the authorized users and restrict access to the unauthorized users.

3. Access tokens, such as keys, are the traditional form of physical access authentication.

a) Keys are paired exclusively with a lock or a set of locks, and they are not easily changed.

b) It is easy to add an authorized user by giving them a copy of the key, but it is much difficult to give that user selective access unless that specified area is already set up as a separate key.

c) It is also very difficult to take access away from a single key or key holder, usually requiring a rekey of the whole system.

4. In many cases, physical access authentication has moved to contactless radio frequency cards and readers.

a) When passed near a card reader, the card sends out a code via radio.

b) The reader picks up this code and transmits it to the control panel.

c) The control panel checks the code against the reader it is being read from and the type of access the card has in its database.

d) The advantages of this kind of token-based system include the fact that any card can be deleted from the system without affecting any other card or the rest of the system. All doors connected to the system can be segmented in any form or fashion to create multiple access areas, with different permissions for each.

5. Newer technologies are adding capabilities to the standard token-based systems. The advent of smartcards, cards that contain integrated circuits, has enabled cryptographic types of authentication. The primary drawback of this kind of token-based authentication is that the token is authenticated. Therefore, the theft of the token could allow anyone who possesses the token access the system.

6. Biometrics uses the measurement of certain biological factors for identifying one specific person.

a) These factors are based upon parts of the human body that are unique. When used for authentication, a computer takes the image of the factor, such as fingerprints, and reduces it to a numeric value.

b) When users enter an area, they get re-scanned by the reader, and the computer compares the numeric value being read to the one stored in the database.

c) As these factors are unique, theoretically only the actual authorized persons can open the door.

8. Biometrics takes an analog signal, like a fingerprint or a face, and attempts to digitize it, and then match it against the digits that are in the database. Therefore, it is not necessary that it may encode the exact results twice.

9. As a result, most systems have tried to allow a certain amount of error in the scan while not allowing too much. This introduces the concept of false positives and false negatives.

a) A false positive is when a biometric is scanned and allows access to someone who is not authorized.

b) A false negative is when the system denies access to someone who is authorized.

10. The other concern with biometrics is that if an attacker is able to steal the uniqueness factor that the machine scans and is able to reproduce that factor, that person has the access.

11. Another problem with biometrics is that parts of the human body can change, forcing the biometric system to allow a higher tolerance for variance in the biometric being read.

12. Multiple-factor authentication is the combination of two or more types of authentication. The three broad categories of authentication are:

a) What you are (such as biometrics)

b) What you have (such as tokens)

c) What you know (such as passwords)

13. Two-factor authentication combines any two of these before granting access.

14. Three-factor authentication would combine all the three types, such as a smartcard reader that asks for a PIN number before enabling a retina scanner.

15. Multiple-factor authentication methods greatly enhance security by making it difficult for an attacker to obtain all the correct materials for authentication.

a) They protect against the risk of stolen tokens, as the attacker also needs to have the correct biometrics, password, or both.